Question

I have a WCF service being hosted over https with a self-signed certificate. I’m having trouble programatically creating the binding: specifically the portion of the endpoint behavior.

My Service config looks like this:

  <system.serviceModel>
        <behaviors>
            <serviceBehaviors>
                <behavior name="">
                    <serviceMetadata httpsGetEnabled="true" />
                    <serviceDebug includeExceptionDetailInFaults="false" />
                </behavior>
            </serviceBehaviors>

          <endpointBehaviors>
            <behavior name="DisableServiceCertificateValidation">
              <clientCredentials>
                <serviceCertificate>
                  <authentication certificateValidationMode="None"
                                  revocationMode="NoCheck" />
                </serviceCertificate>
              </clientCredentials>
            </behavior>
          </endpointBehaviors>

        </behaviors>
        <bindings>
            <customBinding>
                <binding name="ContactEmail.Web.EmailService.customBinding0">
                    <binaryMessageEncoding />
                  <httpsTransport/>
                </binding>
            </customBinding>
        </bindings>
        <serviceHostingEnvironment aspNetCompatibilityEnabled="true" />
        <services>
            <service name="ContactEmail.Web.EmailService">
                <endpoint address="https://xxxxxxxxxxxxxx/EmailService/EmailService.svc" binding="customBinding" bindingConfiguration="ContactEmail.Web.EmailService.customBinding0" contract="ContactEmail.Web.EmailService" behaviorConfiguration="DisableServiceCertificateValidation" />
                <endpoint address="mex" binding="mexHttpsBinding" contract="IMetadataExchange" />
            </service>
        </services>
    </system.serviceModel>

And when I use the “Add Service Reference” feature, the generated client works as expected. Given that I call set up a Cert Validation Callback like this:

System.Net.ServicePointManager.ServerCertificateValidationCallback = ((sender, certificate, chain, sslPolicyErrors) => true);

However, rather than feed the service configuration through a config file on the client, I need to set it programmatically, because the call will be part of a commonly shared library. So, I’m trying to do this by providing my own parameters to the client constructor like:

var myClient = new EmailServiceClient(GetBinding(), new EndpointAddress(Strings.EmailServiceEndpointAddress));

In GetBinding(), I create CustomBinding with BindingElements like HttpsTransportBindingElement, BinaryMessageEncodingBindingElement and SecurityBindingElement.CreateSecureConversationBindingElement(SecurityBindingElement.CreateUserNameOverTransportBindingElement()).

Do you know how I can specify things like certificateValidationMode=”None” and revocationMode=”NoCheck” or if I’m doing anything wrong?

Answer 1

SecureConversation is implementation of WS-SecureConversation => advanced message level security where special security token is created during first call to the service (authenticated by the message security mode passed as parameter to the binding element creation) and this token is used to secure subsequent messages. This security also forms something know as security context or security session.

Your current binding in config file is not using SecureConversation so your binding defined in code is not compatible with your service.